inbound vs outbound access-list and MLS 6500

[Andreas Martensson]

I've been thinking about the mls cache entrys and inbound vs outbound accesslists. If i have an inbound acces list to an interfac the router inspects the packet before actually routing it. This improves router load when packets should be dropped. But an inbound access-list doesn't get mls cached and therefor the flow must pass up to the router before forwarding packets. So witch is the smartest way to do it? Letting the router drop packets before they get routed or populate the mls cache and drop packets on outbound? The router only process the route once since in's in the mls cache?

Am i getting this wrong?

/Andreas

[mmellet]

Standard and extended IOS ACLs are used to classify packets. Classified packets can be subject to a number of features such as access control (security), encryption, policy-based routing, and so on. Standard and extended IOS ACLs are only configured on router interfaces and applied on routed packets.

http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration_guide_chapter09186a008007fa38.html

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a00801609f6.html